CVE-2026-14565: WordPress Plugin XSS Vulnerability

CVE-2026-14565 Overview

CVE-2026-14565 is a stored Cross-Site Scripting (XSS) vulnerability in the Advanced Customized Prompts WordPress plugin through version 1.0.1. The plugin fails to enforce capability, ownership, or nonce checks when saving popup configuration to a product. It also fails to escape stored values on output. Any authenticated user, including a low-privileged subscriber, can inject JavaScript that executes in the browser of visitors viewing the affected product. The issue is tracked under CWE-79.

Critical Impact
A subscriber-level account can persist arbitrary JavaScript on product pages, enabling session theft, credential harvesting, and drive-by redirection targeting site visitors and administrators.

Affected Products

Advanced Customized Prompts WordPress plugin, all versions through 1.0.1
WordPress sites that permit user registration at the subscriber role or higher
WooCommerce or product-driven sites that display popup content rendered by the plugin

Discovery Timeline

2026-09-11 - CVE-2026-14565 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-14565

Vulnerability Analysis

The Advanced Customized Prompts plugin exposes a save handler that writes popup configuration data to product post meta. The handler does not verify the caller's capability, ownership of the target product, or a valid WordPress nonce. As a result, authenticated requests from any role, including subscribers, are accepted and persisted.

On output, the plugin renders stored popup values directly into product page HTML without applying esc_html, esc_attr, or wp_kses sanitization. Injected <script> payloads, event handlers, or javascript: URIs execute in the context of any visitor who loads the affected product page. Because administrators regularly view product pages, this creates a viable path to session hijacking and privilege escalation through admin session abuse.

Root Cause

The root cause is a combination of two defects: missing authorization on the save endpoint and missing output escaping on the render path. WordPress plugin security guidance requires current_user_can() capability checks, check_admin_referer() or wp_verify_nonce() nonce validation, and context-appropriate escaping on output. The plugin implements none of these controls for popup configuration.

Attack Vector

An attacker registers or uses an existing subscriber account. The attacker sends a crafted request to the popup save handler, referencing a target product ID and providing a JavaScript payload in a configuration field. WordPress accepts the request and stores the payload against the product. Any subsequent visitor to that product page executes the payload in their browser session. User interaction on the front end is required to trigger execution, which aligns with the scope-changed nature of stored XSS impacting third parties.

See the WPScan Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-14565

Indicators of Compromise

Product post meta entries containing <script>, onerror=, onload=, or javascript: strings written by the plugin
HTTP POST requests to plugin AJAX or admin-post endpoints originating from subscriber-role accounts
Unexpected outbound requests from visitor browsers to attacker-controlled domains when loading product pages
New or modified administrator accounts created shortly after subscriber activity on product pages

Detection Strategies

Query the wp_postmeta table for meta keys created by the plugin and grep values for HTML tag characters or script-related tokens
Review WordPress access logs for POST requests to the plugin's save endpoint correlated with low-privileged user sessions
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution on product pages

Monitoring Recommendations

Alert on creation or modification of administrator accounts following subscriber authentication events
Monitor web server logs for authenticated requests to plugin endpoints from accounts that have never previously interacted with product administration
Instrument front-end error and CSP violation reporting to detect unexpected script sources on product pages

How to Mitigate CVE-2026-14565

Immediate Actions Required

Deactivate and remove the Advanced Customized Prompts plugin until a patched version is released
Audit all product post meta for injected script content and remove malicious entries
Force password resets for administrator accounts that viewed affected product pages during the exposure window
Disable open user registration or restrict the default new-user role to a value that cannot reach the vulnerable endpoint

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. The vulnerability affects the plugin through version 1.0.1. Monitor the WPScan advisory and the plugin's WordPress.org page for a fixed release. Apply the update as soon as it is available.

Workarounds

Remove the plugin from production sites until a fix is released
Restrict access to the plugin's AJAX and admin-post endpoints at the web server or Web Application Firewall (WAF) layer
Set default_role to a value that limits access, and disable users_can_register in WordPress General Settings
Deploy a strict Content Security Policy that blocks inline scripts on product pages to limit XSS payload execution

bash

# Disable open registration and harden default role in wp-config.php or via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber

# Remove the vulnerable plugin
wp plugin deactivate advanced-customized-prompts
wp plugin delete advanced-customized-prompts